The Data Protection (Adequacy) (United States of America) Regulations 2023 – UK extension to the EU-US Data Privacy Framework - Impact Assessment statement from the RPC
Regulatory Policy Committee statement about the impact assessment relating to the Data Protection (Adequacy) (United States of America) Regulations 2023 – UK extension to the EU-US Data Privacy Framework
Update - 17th October
On receipt of a revised IA on 20th September from DSIT, the RPC resumed its scrutiny of the IA and has issued its opinion to the department on 16th October. The opinion can be found here.
Statement – 21st September
The RPC produces opinions of impact assessments (IA) to help departments ensure that the evidence and analysis in them is sufficiently robust. We provide an independent opinion to assist final ministerial decision making and parliamentary scrutiny of regulatory proposals. We publish these to assist parliamentarians and to ensure that they are available to external stakeholders. Government departments are expected to submit IAs to the RPC in time for the RPC to issue an opinion before the relevant legislation is laid before Parliament.
The IA for the regulations was first submitted on 4th August for RPC scrutiny. The RPC’s initial review of the IA, sent to the Department for Science, Innovation and Technology (DSIT) on 15th September, found that it was not sufficiently robust, and identified areas where improvements should be made. We considered that the points raised would generate a red-rated opinion, if not addressed adequately.
Following discussions, DSIT submitted a revised IA on 20th September. The Data Protection (Adequacy) (United States of America) Regulations 2023 were laid before Parliament on 21st September.
The RPC will now resume its scrutiny and provide a published opinion as soon as is possible to assist both DSIT and Parliament.